Skip to content
OpenAdvisories
High · 7.3 Public exploit CVE-2026-55957 BIT-tomcat-2026-55957EUVD-2026-40233GHSA-7895-gffq-w6jq

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Published Jun 29, 2026 · Updated Jun 30, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat Package: org.apache.tomcat:tomcat-catalina Package: org.apache.tomcat.embed:tomcat-embed-core Package: tomcat10 Package: tomcat10 Package: tomcat11 Package: tomcat11 Package: tomcat6 Package: tomcat7 Package: tomcat8 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 11.0.0-M1 – ≤ 11.0.4, 10.1.0-M1 – ≤ 10.1.36, 9.0.0.M1 – ≤ 9.0.100, 8.5.0 – ≤ 8.5.100, 7.0.0 – ≤ 7.0.109 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat10 10.1.40-1 —
Debian 14 tomcat11 11.0.5-1 —
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat10 10.1.52-1~deb13u1 —
Debian 13 tomcat11 11.0.15-1~deb13u1 —
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat10 10.1.52-1~deb12u1 —
Debian 12 tomcat9 9.0.70-2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 tomcat9 +2 No fix yet —
Ubuntu 26.04 LTS tomcat9 +2 No fix yet —
Ubuntu 25.10 tomcat9 +2 No fix yet —
Ubuntu 24.04 LTS tomcat9 +1 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —
Ubuntu Pro 20.04 LTS tomcat9 No fix yet —
Ubuntu Pro 18.04 LTS tomcat8 +1 No fix yet —
Ubuntu Pro 16.04 LTS tomcat7 +1 No fix yet —
Ubuntu Pro 14.04 LTS tomcat6 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tomcat +7 1:10.1.49-1.el10 RHSA-2026:18537
RHEL 10 tomcat9 +7 1:9.0.110-2.el10_2 RHSA-2026:18536
RHEL 9 tomcat +7 1:9.0.110-2.el9_8 RHSA-2026:18916
RHEL 8 tomcat +7 1:9.0.120-1.el8_10 RHSA-2026:68677
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS tomcat +7 1:10.1.49-1.el10_0 RHSA-2026:67164
RHEL 10.0 EUS tomcat9 +7 1:9.0.120-1.el10_0 RHSA-2026:67163
RHEL 9.6 EUS tomcat +7 1:9.0.120-1.el9_6 RHSA-2026:68659
RHEL 9.4 E4S tomcat +7 1:9.0.120-1.el9_4 RHSA-2026:68679
RHEL 9.2 E4S tomcat +7 1:9.0.120-1.el9_2 RHSA-2026:68678
RHEL 8.8 TUS tomcat +7 1:9.0.120-1.el8_8 RHSA-2026:68680
RHEL 8.8 E4S tomcat +7 1:9.0.120-1.el8_8 RHSA-2026:68680
Red Hat Hardened Images 1 tomcat10 +9 1:10.1.56-1.hum1 RHSA-2026:29203
Red Hat Hardened Images 1 tomcat11 +9 1:11.0.23-0.1.hum1 RHSA-2026:32960

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 tomcat +7 1:9.0.120-1.el8_10 ALSA-2026:68677

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 tomcat 1:9.0.120-1.el8_10 RLSA-2026:68677

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat10 +7 1:10.1.39-1.amzn2023.0.1 ALAS2023-2025-910
Amazon Linux 2023 tomcat9 +7 1:9.0.102-1.amzn2023.0.1 ALAS2023-2025-911
Amazon Linux 2 tomcat +9 7.0.76-10.amzn2.0.17 ALAS2-2026-3864

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 tomcat +7 1:9.0.120-1.el8_10 ELSA-2026-68677

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • mdvpat/CVE-2026-55957-PoC ★ 0 · Aug 7, 2026

    Reproducible Docker lab for the Apache Tomcat JNDIRealm GSSAPI authentication bypass

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.5 11.0.5 GHSA-7895-gffq-w6jq
Maven org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.37 10.1.37 GHSA-7895-gffq-w6jq
Maven org.apache.tomcat:tomcat >= 9.0.0.M1, < 9.0.101 9.0.101 GHSA-7895-gffq-w6jq
Maven org.apache.tomcat:tomcat >= 8.5.0, <= 8.5.100 — GHSA-7895-gffq-w6jq
Maven org.apache.tomcat:tomcat <= 7.0.109 — GHSA-7895-gffq-w6jq
Maven org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.5 11.0.5 GHSA-7895-gffq-w6jq
Maven org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.37 10.1.37 GHSA-7895-gffq-w6jq
Maven org.apache.tomcat:tomcat-catalina >= 9.0.0.M1, < 9.0.101 9.0.101 GHSA-7895-gffq-w6jq
Maven org.apache.tomcat:tomcat-catalina >= 8.5.0, <= 8.5.100 — GHSA-7895-gffq-w6jq
Maven org.apache.tomcat:tomcat-catalina <= 7.0.109 — GHSA-7895-gffq-w6jq
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.5 11.0.5 GHSA-7895-gffq-w6jq
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.37 10.1.37 GHSA-7895-gffq-w6jq
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.101 9.0.101 GHSA-7895-gffq-w6jq
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100 — GHSA-7895-gffq-w6jq
Maven org.apache.tomcat.embed:tomcat-embed-core <= 7.0.109 — GHSA-7895-gffq-w6jq

Advisories 19

References